Hacker News Reader

Comment by donmcronald | Hacker News Reader

> Shoutout to my Google Mini which ignores DNS servers in the DHCP response.

Put Roku on that list. They also break in a spectacular fashion if you redirect the queries to a DNS server that returns NXDOMAIN. Its like they query in an infinite loop with no rate limits. They absolutely hammer the DNS server.

View on HN

I made it a point to NAT redirect all outbound requests to UDP 53 in our enterprise back to our enterprise DNS server. It would sometimes piss off our engineers, when they realized 8.8.8.8 was somehow resolving our internal DNS names, but if they came to us and nicely explained their use-case then we excluded them from the NAT rule.

That's very unkind. It probably took them a good long while to figure out that you did that, in the middle of troubleshooting something else. Why not just block that traffic?

People like you are the reason DoH is being rolled out. I hate the concept, but I would immediately enable it if I caught my IT unapologetically getting in the way of my work like you do.

They seemed to like it less when we blocked it, as their stuff completely failed to work.

Yes, but at least they immediately knew why.

Great when you debug something for ages, just to find out your company's DNS setup is broken. Because it can't be DNS, right? /s

Compliance sucks, but it's required. I didn't make up the rules, just implemented and enforced them.

Sorry, my snarkiness was not meant personal, I know you're not to blame :)

I had add port 53 NAT redirect to my home network.

Kindle Fire tablet has hard-coded Google's 8.8.8.8 DNS server, bypassing the Pi-Hole ad blocker.

Reply on news.ycombinator.com